Work out token expiry window instantly with clear inputs, formula shown and shareable results.
Access token lifetime bounds the damage from a stolen bearer token, because a JWT cannot be revoked without central state — it simply stays valid until it expires. Short lifetimes of 5 to 15 minutes are the standard mitigation, with a long-lived refresh token held more securely and subject to rotation and reuse detection so that theft is at least detectable.
Exposure window
replayable requests = access token lifetime x request rate; refreshes per day = 1440 / access token minutes
Because they are bearer credentials that cannot be revoked. A token valid for 24 hours gives an attacker a full day of access after a single leak from a log or browser store.
Each refresh issues a new refresh token and invalidates the old one. If an old token is presented again, that proves theft and the whole family can be revoked.